Tag Info

New answers tagged

2

Basically, you don't need to trust an OpenID provider: the user does. Let's compare, from the strict perspective of authentication, passwords with OpenID. Password: User: “hey, server, it's me! You know it's me because no one else knows the magic word correcthorsebatterystaple, which I told you when I created the account.” OpenID: User: “hey, server, it's ...


10

OAuth and OpenID don't send your password to the sites you use OAuth/OpenID providers to login with, so no. Not unless the attack is performed on the OAuth/OpenID provider and provider's servers are vulnerable to CVE-2014-0160 (The Heartbleed Bug). It is however possible, of course provided that sites you're logging into using OAuth/OpenID providers are ...



Top 50 recent answers are included